CODEWITHSUNDEEP
csecurityopenssllibcryptoyara
Sundar
Sundar

Reputation: 11

Security vulnerability reported as backdoor when using OpenSSL's librypto.a library

My C code uses librypto.a library to link to the compiled source code at the final stage for implementing RSA algorithm. When a vulnerability scan was done, it comes back with a YARA signature match for the following:

YARA signature "ldpreload" classified file as as "backdoor" based on indicators: "dlopen,dlsym,fopen,fopen64,__fxstat,accept,Accept,open,Open,OPEN,opendir,readdir"

This is because I use the libcrypto.a library from Open SSL. I thought this is a widely used library for implementing crypro algorithms. How to mitigate this issue? Should try to get this whitelisted as I was not able to find any other way of implementing RSA in C without having to use OpenSSL libraries.

Upvotes: 1

Views: 208

Answers (0)

Related Questions